Discovery Service for Shibboleth IdP (as a Proxy)

[Muhammad Farhan SJAUGI]

Hi Janne,

Thank you for the information. This is what I am looking for.

I've visited the GH repo for your solution; However, I couldn't find the
instruction/guide on how I should configure my shibboleth IdP in order to
use the "plugin", and also how can I list the IdPs/DSes or set different
authentication methods.

Hence, would you mind to guide me on this?

Regards

--
*Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc.*

*VP (Engineering and Services)*
SIFULAN Malaysian Access Federation
Email: farhan at sifulan.my | Website: https://www.sifulan.my
PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C
MBOT: GT20040131 |  ORCID: https://orcid.org/0000-0001-8497-1768



On Tue, Oct 17, 2023 at 2:55 PM Janne Lauros <janne.lauros at csc.fi> wrote:

> Hi!
>
> How we have done it at CSC - this is our in-house solution - is running a
> discovery flow first. The flow presents authentication options to the user
> as logos and text. See following on how it looks:
>
> https://notebooks.rahtiapp.fi/oauth2?rd=%2Foauth2
>
> 1. First selection leads to Password flow
> 2. Second selection leads to SAML2 flow using Haka federation discovery
> 3. Third selection leads to SAML2 flow using Virtu federation discovery
>
> The outcome of the selection for internal machinery is:
>
> - Next flow to run. In our case usually saml2, oidc or password flow.
> Could be anything.
> - Authenticating Authority. This we use only for saml2 and oidc flows i.e.
> flows that need to be informed of the upstream provider.
>
> If the user has selected option that sets saml2 as next authentication
> flow we use information encoded to Authenticating Authority to set either
> upstream entity id in bean shibboleth.authn.SAML.discoveryFunction or
> upstream discovery in bean shibboleth.authn.discoveryURLStrategy.
>
> The discovery flow https://github.com/CSCfi/shibboleth-idp-authn-discovery
> has been used by us in some form since 2016 or for as long a we have been
> running Shibboleth based proxies. Unfortunately as it has been for in-house
> use only the documentation is scarce. If there is no generic solution for
> you and you want to have a go with this we are happy to document and maybe
> repackage the module as proper plugin. We have two digit number of
> shibboleth proxies running in different environments, most using this
> module as discovery.
>
>  BR Janne
>
>
>
> ------------------------------
> *From: *"Shib Users" <users at shibboleth.net>
> *To: *"Shib Users" <users at shibboleth.net>
> *Cc: *"Muhammad Farhan SJAUGI" <farhan at sifulan.my>
> *Sent: *Tuesday, 17 October, 2023 02:38:38
> *Subject: *Discovery Service for Shibboleth IdP (as a Proxy)
>
> Hi,
> I am trying to set up Shibboleth IdP (as a Proxy IdP) and use SAML as the
> authentication protocol to the backend/actual authentication server.
> However, there are more than one authentication servers that the users can
> choose from to authenticate themself. Based on my "research" at Shibboleth
> IdP documentation, this is possible by either defining the shibboleth.authn.SAML.discoveryFunction
> bean or pointing to some WAYF/DS service in the discoveryURL configuration.
> So, I am wondering if there is any (simple) embedded WAYF/DS solution that
> we can set up on the Shibboleth IdP server itself? either as a
> SAML.discoveryFunction or a WAYF/DS service (and set them at the
> discoveryURL).
>
> Thank you.
>
> --
> *Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc.*
>
> *VP (Engineering and Services)*
> SIFULAN Malaysian Access Federation
> Email: farhan at sifulan.my | Website: https://www.sifulan.my
> PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C
> MBOT: GT20040131 |  ORCID: https://orcid.org/0000-0001-8497-1768
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231017/fe5ff706/attachment.htm>